Bug 2044575 (CVE-2022-0400) - CVE-2022-0400 kernel: Out of bounds read in the smc protocol stack [NEEDINFO]
Summary: CVE-2022-0400 kernel: Out of bounds read in the smc protocol stack
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2022-0400
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2040604 2047638
Blocks: 2044577
TreeView+ depends on / blocked
 
Reported: 2022-01-24 19:03 UTC by Pedro Sampaio
Modified: 2026-08-24 02:07 UTC (History)
55 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2022-01-31 10:01:37 UTC
Embargoed:
junjie.cao: needinfo? (psampaio)


Attachments (Terms of Use)

Description Pedro Sampaio 2022-01-24 19:03:01 UTC
A out-of-bounds read vulnerability in the smc protocol stack in the Linux kernel.

References:

https://bugzilla.redhat.com/show_bug.cgi?id=2040604

Comment 5 Rohit Keshri 2022-01-28 07:56:48 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2047638]

Comment 6 Salvatore Bonaccorso 2022-01-31 07:59:43 UTC
Hi

Are there any details available for this CVE? The referenced bug is not public. Is this something already with a fix in mainline?

Regards,
Salvatore

Comment 7 Product Security DevOps Team 2022-01-31 10:01:34 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-0400

Comment 10 Rohit Keshri 2022-02-07 08:09:22 UTC
In reply to comment #6:
> Hi
> 
> Are there any details available for this CVE? The referenced bug is not
> public. Is this something already with a fix in mainline?
> 
> Regards,
> Salvatore

Hi Salvatore,

Not yet fixed in the mainline, thanks to ziming zhang, who has reported this.  
https://bugzilla.redhat.com/show_bug.cgi?id=2040604

Comment 11 imamaja 2023-03-16 11:46:37 UTC Comment hidden (spam)
Comment 12 course 2023-07-08 10:34:44 UTC Comment hidden (spam)
Comment 13 course 2023-07-08 10:36:15 UTC Comment hidden (spam)
Comment 16 gauri kanade 2023-10-31 04:46:27 UTC Comment hidden (spam)
Comment 17 Red Hat Bugzilla 2024-02-29 04:25:02 UTC
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days

Comment 18 salaar 2024-12-10 10:16:51 UTC Comment hidden (spam)
Comment 19 Data analytics masters 2025-04-01 06:57:12 UTC Comment hidden (spam)
Comment 20 Jiahao Li 2025-12-26 06:15:05 UTC
Is there any detailes for this vulnerability? It has been over two years, and the CVE remains undisclosed.

Comment 21 Pedro Sampaio 2026-02-16 12:45:27 UTC
(In reply to Jiahao Li from comment #20)
> Is there any detailes for this vulnerability? It has been over two years,
> and the CVE remains undisclosed.

This is not fixed in the mainline yet, please see comment #10.
Reporter is unresponsive se we don't more about it.

Comment 22 junjie.cao 2026-08-19 06:57:14 UTC
This CVE is being triaged for the Yocto Project / OpenEmbedded kernel
recipes [1]. The public record for CVE-2022-0400 identifies no affected
code: this bug is closed NOTABUG with "There was no shipped kernel
version that was seen affected by this problem. These files are not
built in our source code", and the originating report, bug 2040604
(marked "not public" in Debian's security tracker), is not accessible.

That statement is specific to Red Hat's kernel configuration.
Distributions building other configurations cannot triage this CVE
without knowing which source files or Kconfig options were implicated.

Could bug 2040604 be made public, or at least the affected files or
options be named here? If the report was found invalid for all
configurations rather than merely not built in RHEL, stating that
would also settle it.

[1] https://lore.kernel.org/openembedded-core/20260812072842.1176341-6-junjie.cao@linux.dev/

Comment 23 junjie.cao 2026-08-24 02:07:42 UTC
Red Hat PSIRT responded to comment 22 through a support ticket
(PSIRTSUPT-22046). Bug 2040604 remains internal, but they identified
the affected code: in CONFIG_SMC builds, the v2_ext_offset field of an
incoming CLC proposal message is used to compute a memory offset
without validation - smc_clc_msg_hdr_valid() ->
smc_clc_msg_prop_valid() -> smc_get_clc_v2_ext() (net/smc/smc_clc.h) -
an out-of-bounds read.

This matches mainline history. The unchecked read exists since V2 CLC
proposal parsing was added in v5.10 (commit 8c3dca341aea); at the time
of this report smc_get_clc_v2_ext() checked the offset only for zero
and smc_clc_msg_prop_valid() dereferenced the result on the server
receive path. Fixed in v6.13-rc4 by commit 7863c9f3d24b ("net/smc: check
v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg"), which
the kernel CVE team assigned CVE-2024-49568 (introduced in 5.10, fixed
in 6.6.68, 6.12.7 and 6.13):

https://lore.kernel.org/linux-cve-announce/2025011142-CVE-2024-49568-e5f6@gregkh/

So CVE-2022-0400 describes the defect later fixed as CVE-2024-49568.
Linking the two records, or adding the fix information to
CVE-2022-0400, would let downstream trackers close it. I am recording
it as fixed from 6.13 in the Yocto Project / OpenEmbedded kernel
triage:

https://lore.kernel.org/openembedded-core/20260812072842.1176341-1-junjie.cao@linux.dev/


Note You need to log in before you can comment on or make changes to this bug.